Hi everybody, this happend to me too in one of the websites I manage, two days ago and two weeks ago four of the websites I manage were infected with malware. I’ve been investigating since then to see how the malware got into my sites and I am pretty sure that this script is the problem.
Let me explain what happen and forgive my poor english. You may have this php curl code inserted in your website because it might be a template downloaded for free from somewhere and then edited. PHP can be inserted into any template (wp – joomla – drupal – php websites and may be more).
What does the scrip do? Ok, I took this part from hakipedia – “PHP supports libcurl which currently supports the http, https, ftp, gopher, telnet, dict, file, and ldap protocols. libcurl also supports HTTPS certificates, HTTP POST, HTTP PUT, FTP uploading (this can also be done with PHP’s ftp extension), HTTP form based upload, proxies, cookies, and user+password authentication. cURL can be used in conjunction with PHP scripts for bruteforce attacks (including SQL injection table brute forcing), reconnaissance attacks, spoofing, and data theft.”
As you can see your information might be in bad hands by now… I recommend to seek and delete the script and change all passwords (ftp, data base, wp users, everything.
I’ve seen this scrip in many themes including broadway – thesis – supportpress – viroshop – argentum – faultpress well many many more. (All free downloaded – don’t know about payed copies).
